An unauthenticated information disclosure vulnerability in Statping-ng version 0.91.0 exposes sensitive data through improper API request handling.

This vulnerability involves an improper information disclosure flaw where an unauthenticated attacker can retrieve sensitive configuration or system data by sending crafted requests to the oauth, amazon_sns, or export API endpoints.

The vulnerability carries a CVSS score of 7.5, indicating a high severity risk that could lead to significant data compromise. Successful exploitation allows unauthorized parties to access sensitive application information, potentially exposing credentials or internal system configurations that could facilitate further attacks or unauthorized access to integrated services.

Immediate Action: As no specific patch version is currently available, administrators should restrict network access to the affected API endpoints and disable the vulnerable oauth, amazon_sns, and export features if they are not strictly required for business operations.

Proactive Monitoring: Security teams should implement monitoring for unusual patterns in API traffic, specifically focusing on unauthorized access attempts targeting the oauth, amazon_sns, and export endpoints within the application logs.

Compensating Controls: Deploy a Web Application Firewall (WAF) to filter and block suspicious requests directed at the identified API paths, effectively mitigating the risk of exploitation until a formal vendor-supplied security update is released.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research repository at github.com/Ev3rR3d/Statping_Poc.

Given the high CVSS score and the public availability of a functional proof-of-concept, this vulnerability presents a clear and present danger to affected deployments. Organizations must prioritize hardening their Statping-ng instances by limiting exposure of the affected API endpoints and monitoring for anomalous traffic until the vendor provides an official remediation.